i think i have got virus

[Slartybart]

Quarantine the file for now.

Is there another window behind the one you posted?

Edit: I think that window is just showing the scan results - you can close it with the X.

 

[Slartybart]

Save any work, close all applications

One more - > download and launch Old Timer (OT) - Temp File Cleaner (TFC)

Reboot immediately after running OT

 

[Slartybart]

Sorry - forgot to ask you to check if Gsrld.dll still exists in
D:\Max Payne 3

If it exists - please rename
Gsrld.dll to Gsrld_dll.renamed

 

[Slartybart]

Please post the ESET log

After running Old timer Temp file cleaner and your system has been restarted, there is one more scanner that wasn't included in the guide: SUPERAntiSpyware - Downloading File (SAS)

Be sure to untick any toolbars offered during the installation and do not accept the free trail of the paid version. The Free version is all you need fro this exercise.

Run a FULL system scan with SAS and post the log. You're doing great.

There were a few issues found by the other scanners - they are minor and relate to customization (desktop icons, std Windows application repalcement - defragger? Text editor?)

There was however one that you should check. I might be reading the log incorrectly but it seems as though your Windows Firewall is turned off. Kaspersky might do this intentionally, but please verify that you have some firewall running.

Look in Control Panel\All Control Panel Items\Action Center and expand the Security section.

 

[Mysterious]

ok sir thanks for replies,i'll do that.i was viewing 6th page & was waiting for u'r reply.i didn't know there was 7th page created lol

Edit-how to quarantite the file & post ESET Scanner log ?
& 1 more question should i tick uninstall in ESET Scanner & click on finish ?

 

[Britton30]

I leave Eset installed so the next time I use it, it only has to update definitions, much quicker.

 

[Mysterious]

I leave Eset installed so the next time I use it, it only has to update definitions, much quicker.

ok but tell me anyone how to quarantite that file & post log ?

 

[Slartybart]

Yeah, stuff like that catches me too

ok sir thanks for replies,i'll do that.i was viewing 6th page & was waiting for u'r reply.i didn't know there was 7th page created lol

ESET should have done the quarantine (or deletion) for you. But... I asked you to check

Sorry - forgot to ask you to check if Gsrld.dll still exists in
D:\Max Payne 3

If it exists - please rename
Gsrld.dll to Gsrld_dll.renamed

The ESET log should be in C:\Program Files\ESET\EsetOnlineScanner\log.txt

You can leave ESET installed as Britton30 suggested. Since it is an on-demand scanner, it does not consume any system resources except disk space. Your choice... you can always download it again if your need the disk space.

Edit-how to quarantite the file & post ESET Scanner log ?
& 1 more question should i tick uninstall in ESET Scanner & click on finish ?

 

[Mysterious]

Yeah, stuff like that catches me too

ok sir thanks for replies,i'll do that.i was viewing 6th page & was waiting for u'r reply.i didn't know there was 7th page created lol

ESET should have done the quarantine (or deletion) for you. But... I asked you to check

Sorry - forgot to ask you to check if Gsrld.dll still exists in
D:\Max Payne 3

If it exists - please rename
Gsrld.dll to Gsrld_dll.renamed

The ESET log should be in C:\Program Files\ESET\EsetOnlineScanner\log.txt

You can leave ESET installed as Britton30 suggested. Since it is an on-demand scanner, it does not consume any system resources except disk space. Your choice... you can always download it again if your need the disk space.

Edit-how to quarantite the file & post ESET Scanner log ?
& 1 more question should i tick uninstall in ESET Scanner & click on finish ?

i decided to leave ESET installed & yes file was there in Max Payne 3 & i renamed it.
ESET log file below >>

 

[Slartybart]

Hmmm, ESET caught it but didn't do anything. Ok, maybe something wasn't ticked for the scan... in anycase, the file has been renamed and is out of the way.

Have you rebooted? No? Please do before the next steps

A few more (I know I said the guide would be enough, but....)

Finish with Post# 62 (Old timer) and Post# 64 (SuperAntiSpyware)

 

[Mysterious]

Hmmm, ESET caught it but didn't do anything. Ok, maybe something wasn't ticked for the scan... in anycase, the file has been renamed and is out of the way.

Have you rebooted? No? Please do before the next steps

A few more (I know I said the guide would be enough, but....)

Finish with Post# 62 (Old timer) and Post# 64 (SuperAntiSpyware)

hmm done with TFC(old timer).but after reboot a new problem arises,taskbar hiding itself & when i'm on desktop taskbar colour is in aero & when in google chrome,taskbar colour is basic.how to fix it ?
TFC was safe or not or it messed up with windows ?
and 1 more question RogueKiller created a folder on my desktop RK_Quarantite & it have some registration entries.should i double click on them each ?

Edit-downloading Super antispyware.file size is big 27.87 mb,will take some time !!

 

[Slartybart]

Old Timer TFC is safe, but it does clean out any and all temporary files. It's not clear that OT caused the symptoms you reported, most likely one of the other scanner 'fixed' a potential issue. The scanners can't tell the difference between a malware modification and a user modication, so they punt and fix what might be a malware modification.

You'll have to personalize your desktop - some things were marked as PUPs or PUMs
Potentially Unwanted | Programs or Modifications
A clean system is worth the small effort required to personalize a system.

Leave the RogueKiller folders/files on your desktop alone for now.



scan results recap

• JRT-> nothing reported
• AdwCleaner
  
  File Deleted : C:\Program Files\Uninstall.exe
  Registry Key Deleted :
  HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ASUS_Screensaver
  HKLM\SOFTWARE\Classes\Interface\{813A22E0-3E2B-4188-9BDA-ECA9878B8D48}
  HKLM\SOFTWARE\Classes\Interface\{BCFF5F55-6F44-11D2-86F8-00104B265ED5}
  HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0FF2AEFF45EEA0A48A4B33C1973B6094
  
  [ File : C:\Users\Love\AppData\Local\Google\Chrome\User Data\Default\preferences ]
  ​
• RogueKiller
  
  --Scan log
  [HJ POL][PUM] HKLM\[...]\System : ConsentPromptBehaviorAdmin (0) -> FOUND
  [HJ POL][PUM] HKLM\[...]\System : EnableLUA (0) -> FOUND
  [HJ DESK][PUM] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND
  [HJ DESK][PUM] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND
  
  --Remove log
  [HJ POL][PUM] HKLM\[...]\System : ConsentPromptBehaviorAdmin (0) -> REPLACED (2)
  [HJ POL][PUM] HKLM\[...]\System : EnableLUA (0) -> REPLACED (1)
  [HJ DESK][PUM] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> REPLACED (0)
  [HJ DESK][PUM] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> REPLACED (0)
  ​
• Malwarebytes - quick scan only... should have been full scan
  --> Nothing found
• Rkill
  
  Checking for processes to terminate:
  * C:\Windows\System32\ACEngSvr.exe (PID: 3504) [WD-HEUR]
  1 proccess terminated!
  Performing miscellaneous checks:
  * Windows Firewall Disabled
  [HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
  "EnableFirewall" = dword:00000000
  Searching for Missing Digital Signatures:
  * C:\Windows\System32\UxTheme.dll : 2,49,856 : 12/29/2013 10:18 PM : 5ae8fd64fc69a242c572968e1d4e6eb2 [NoSig]
  +-> C:\Windows\winsxs\x86_microsoft-windows-uxtheme_31bf3856ad364e35_6.1.7600.16385_none_a5baf0f767e33083\uxtheme.dll : 2,49,856 : 07/14/2009 06:46 AM : 63bfdf555da2075a77d677829c3cccd0 [Pos Repl]
  ​
• TDSSkiller -> nothing reported

 

[Mysterious]

ok i'll scan with super antispyware tommorow.because late night here.super antispyware was going to finish & it stopped in internet download manager.it says cannot download file because of timeout.do u want to know possible reason of data corruption ?
wasted 2 hours of downloading

 

[Slartybart]

The download timed out - what do you mean "possible data corruption"? - is that a message from the download?

I always get a kick when people say they "wasted" time doing something on the computer. It's not funny when you've spent a few hours writing a document and a crash occurs - but people aren't actually doing anything with a download. Other regions might have contraints on usage though - so wasted might apply here.

Have a good nights sleep - we'll skip SuperAntiSpyware.

Instead - have you personalized your system or are there still desktop issues per post# 71 - now would be a good point to make sure your machine is close to how you had it personalized before.

I say close, because there were two items cleaned up by the scans that won't be exact.
Asus screensaver-> can be reclaimed on Asus
uxTheme -> Not really necessary, but you might want it (if so it too can be downloaded, but not recommended)

Then I'd rather you spend time bringing your system up to date using manual Windows Update (WU)
IE 11 is available (your on IE 8) - at a minimum get up to IE 9 (10 has some issues)
There are some other items I noticed, but let WU offer what it thinks is needed.

Post a screenshot of what WU offers,
untick any Silverlight or Bing updates (unless you want them)
- I suggest that you hide those if you don't use them (right click on update - hide)


Then, see how your machine runs for a few days.

 

[Mysterious]

Yes my download was stopped when it going to finish.in internet download manager it says do you want to know possible reason of data corruption ?
I think that was my net problem,because it was too slow
it was in bytes that time,not in kilobytes
see i have a internet plan on my vodafone sim & i use my Nokia X2-01 mobile as modem
they give 50-60 kbps speed untill 2gb usgae.but after 2Gb usage it become really slow 5-6 kbps,sometimes even slow if something more running in baackground.That's why maybe it was in bytes,maybe something was updating in the background
btw i pay really reasonable price for my net 198rs. For 1 month unlimited plan.
here in india net prices are really hight than foreign countries.u're all lucky u born in foreign countries.be proud of u'rself.india is still low in development.in foreign countries u can get speed upto 1Gbps,but here maxium 21 mbps,for that really really high price we have to pay

Edit-yes i personalized my desktop,no issues now.but i'm curious is something messed up with windows,should i restore my system to an earlier time ?
& plz tell me how to uninstall all these programs from my computer that u mentioned in u'r previous posts ?

 

[Mysterious]

i'm going to format my whole hard drive.because i think it's messed up badly & these programs also messed up with windows.which software i should choose for wiping all my hard drive.should i wipe it within windows or with a bootable cd/dvd ? btw i have Mini Tool Partition wizard home edition also...
1 thing i want to show these,they are in order Ist,2nd,third.task manager opened in straight performance tab >>

Edit-my ram showing high usage also :><<

 

[Slartybart]

A clean reinstall is always a guarantee of the best operating environment.

If your machine is 64bit, then I recommend installing Win7 Ult x64. The COA on your machine will allow either 32 or 64 bit install.... it just depends if your machine is 32 or 64 bit.

A few things some people miss
Have your network device drivers on seperate media (CD or Flash drive) - Asus should have them, but you need them BEFORE the clean install

Have your paid program discs available or make sure you can download and instlal them with a license key.

Create your Asus recovery discs

People don't miss this, but it needs to be amplified - Backup your user data!!!!

See: http://www.sevenforums.com/tutorials/219487-clean-reinstall-factory-oem-windows-7-a.html

 

[Mysterious]

Hi guys...still not re-installed because i want to wipe data from my whole drive.so i'll be sure no data & viruses left anywhere.plz tell any good & faster software !!

Edit-btw i have mini tool partition wizard home edition also.but that is very very slow when it wipe data more securely & i should wipe data within windows or a bootable disc of some software would be better ?

 

[Mysterious]

I installed windows 8 pro x64.wiped all partitions with mini tool partition wizard home edition with slow method (Fill sectors with zero & one) by saving my data on other drive while wiping other. Before my cpu usage become normal 0-1 % then again now it stay on 3-4% after i install some important programs on my laptop.is it okay ?

 

[Britton30]

Yes, that seems quite normal.